Open letter to European Commission President Ursula von der Leyen on the skewed selection process for head of European Data Protection Supervisor

Hi CT readers, I’m publishing this open letter here so there’s a public record of the letter I’ve co-written and signed about what looks, walks and talks like a good old-fashioned Brussels stitch-up aimed at weakening the EU organisation that oversees data protection in EU institutions. Thank you, Maria (Comments welcome, as with any other post.)

19 June 2025, by e-mail
 
From: Dr. Maria Farrell, Prof. Douwe Korff and Prof. Ian Brown.
To: President Ursula von der Leyen, European Commission.
cc: Commissioner Michael McGrath, European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection;
Ms. Sirpa Rautio, Director, EU Agency for Fundamental Rights;
Don Javier Zarzalejos, Chair, LIBE committee, European Parliament.
 
Dear President von der Leyen and esteemed colleagues:

We are writing to inform you of procedural irregularities and what appears to be a strongly biased and motivated selection process regarding the appointment of the next European Data Protection Supervisor (EDPS), a key institution protecting the fundamental rights of EU citizens.

The EDPS plays a crucial role in ensuring people’s fundamental rights and freedoms, and in particular their right to data protection, are respected by European Union institutions and bodies.[1] However, the manner and potential outcome of the current selection process for the role of the next head of the EDPS appears to be a clear case of maladminstration and political cronyism.

We raise these issues as EU citizens (MF, DK) and resident (IB) with long-standing interests and backgrounds in privacy and technology policy.

The selection process for the next EDPS has been procedurally aberrant, untransparent, and  appears biased and motivated in its selection methods. It is extremely concerning there have been multiple allegations that an element of gender discrimination has swayed the process. It is equally concerning that we have heard repeated allegations that an element of disability discrimination is involved.

As this process is ongoing and its outcome is of vital importance for the role of privacy and rule of law in a crucial oversight role regarding the European Commission (EC), this is a matter of extreme urgency.
In addition to the procedural irregularities and public impression of interference in the selection process, it is deeply concerning that the apparent lead candidate shortlisted for EDPS — the body trusted to oversee, investigate, and correct the EC regarding data protection — is himself a current official of the EC. This appears to contravene the legal requirement that all candidates for the position shall be “persons whose independence is beyond doubt.”[2] Should such a candidate be appointed as EDPS, this would appear to flout the requirement that the EDPS “shall act with complete independence”[3] in exercising its considerable powers regarding other EU institutions.

The procedural irregularities, apparent biased and motivated nature of the selection, tokenistic manipulation of of the candidatures of female applicants, and the party-political handling of the decision by the EP strongly suggest that this is a flawed procedure with a biased, pre-determined outcome, intended to weaken a key institution of the EU at a critical moment in our fight to preserve fundamental human rights and the rule of law.
Our concern is not to advance the position of any specific candidate, but to highlight irregularities in the current process and urge you to intervene before the role and reputation of the EDPS are damaged.

1      Name of the EU institution.
The European Commission; specifically, DG PERS,[4] which has run the selection process for the European Data Protection Supervisor, with possible inputs from DG JUST.
The EDPS is the EU’s independent data protection authority. It is presently headed by Wojciech Wiewiórowski.
The EDPS supervises how the EU institutions and bodies process personal data to ensure compliance with data protection rules, and advises them on all aspects of personal data processing and related policies and legislation.

Appointment to head of the EDPS is by joint decision of the European Parliament and Council, and is for a term of five years.

2      The matter at issue in this complaint.
The recruitment and selection of the new EDPS, who oversees the EU’s independent data protection authority. The EDPS supervises how the EU institutions and bodies process personal data to ensure compliance with data protection rules, and advises them on all aspects of personal data processing and related policies and legislation. This complaint concerns the appointment process for the EDPS being currently run by DG PERS.

3      What the EU institution or body has done wrong.
The European Commission, specifically DG PERS, is running a recruitment and selection process – with involvement from the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE) – to appoint the new EDPS. The Parliament and Council’s role is to elect the EDPS from the shortlisted candidates provided to them by the EC.

The shortlisting process has been opaque as regards transparency of the selection criteria for shortlisted candidates, has shortlisted a candidate in apparent contravention of treaty requirements for independence, and has excluded stronger candidates from the final stages while including weaker ones to give a misleading appearance of gender equity. All this gives a strong impression of a Commission-led process that was biased and motivated in the selection methods used to produce a shortlist of candidates.

While at the national level there is some precedent for data protection authority heads being appointed from government bodies they then became responsible for supervising, the constitutional role of the EDPS — and hence the requirement for unquestionable independence — are of a different level of criticality entirely for the rule of law to prevail across the EU. The requirement for the independence of the EDPS is clear, and has not been respected in this process.
  
Procedural maladministration
There has been no transparency regarding the selection criteria for shortlisting or interview of candidates, nor the identities of the selection committee. As well as being, in principle, an instance of maladministration regarding such a strategic and sensitive public role, this secrecy contravenes the requirement in the General Data Protection Regulation (Article 53) that a transparent procedure must be used to enable independent supervision under that regulation.[5] The process leaves a strong appearance of being conducted by DG PERS in a manner that is neither independent nor objective. It could not, to any neutral observer, be said to be predictable in its being conducted according to stated criteria and objective considerations.

The selection process has also been marred by the inclusion in the final shortlist of a less experienced female applicant, and the exclusion of a more relevantly qualified and experienced one. This highly unpredictable outcome gives the impression of the tokenistic inclusion in the shortlist of a woman who has no serious possibility of success, a very common and discriminatory tactic seen in selection processes where the outcome and winning candidate is pre-determined. Excluding a more highly qualified woman from a male-dominated shortlist creates the impression of sex discrimination.

As no objective criteria for the shortlisting decision have been made publicly available, nor any post facto reasoning for the selection published, there is a strong impression that a biased and pre-determined selection process has been run to ensure a shortlist with a pre-determined set of candidates, regardless of performance, experience, and qualifications.

Specifically, there appears to be strong evidence of the pre-selection of a shortlist that anticipates the preferences of the European People’s Party, as indicated in the voting outcome of the relevant Europan Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE).

In the light of this appearance of political interference, DG PERS has not provided any public evidence or assurances of its independence, objectivity or transparency.

The impression of partiality and cronyism is strengthened by further procedural irregularities in how the second vote at the EP was carried out – by party group rather than individually – indicating that this is a political decision made with party political preferences and biases foremost, rather than fairly, independently, transparently, objectively and predictably — as the Treaties demand.

Principled maladministration
As a matter both of principle and in accordance with the Treaties, the EDPS must be independent and impartial in relation to other EU institutions, including the European Commission. This requirement for independence — for a position whose core role is oversight of Commission activities — should preclude any consideration of candidates currently employed by the European Commission. The independence requirement is there to ensure that fundamental rights and freedoms are protected without fear or favour, and with no bias – either intended or otherwise – in favour of the instutions the EDPS essentially regulates. It is simply not possible for an employee of one body to take control of its oversight organisation without weakening it; the treaty obligations both in letter and principle are designed to prevent ‘the fox being put in charge of the chicken coop’, however well intentioned the fox.

Shortlisting and appointing such a candidate creates a clear conflict of interest in anyone so employed, and this conflict cannot be mitigated by post hoc measures. In this instance, we understand there has not even been any period of time between one of the shortlisted candidates holding a DG JUST posting and their candidacy for a post that would supervise the conduct of their current employer. This consideration and shortlisting — not to mention the EPP vote in LIBE in favour of this candidate — appears to be in clear violation of treaty and CJEU case law.

If such a candidate were to be appointed, it would weaken the EDPS’s integrity, independence, both perceived and material, regardless of the calibre and good faith of the candidate. (You may also be aware that there are currently several outstanding legal matters between the EDPS and European Commission, putting the potential independence of an EC candidate in question.[6])

In the current circumstances, amidst the stated intent of DG JUST to water down (“simplify”) data protection law, specifically the General Data Protection Regulation, the procedural irregularities and principled maladministration apparent in this selection process appear to be a deliberate attempt to weaken the functioning and undermine the reputation of the EDPS. At a crucial moment when Europe needs above all to protect and uphold the rule of law – particularly with regard to critical matters of data, surveillance, privacy, security, and sovereignty in the technology space – this weakening of a key institution requires your urgent attention.

European treaties and ECJ case law require and should safeguard the complete independence of the EDPS. Respecting them, both in principle and to the letter, is not just a question of avoiding maladministration but a fundamental requirement for maintaining the rule of law.

The current selection process gives all outward impression of having been manipulated in its selection of the shortlist, management of the final candidate interview according to secret criteria, and the subsequent dealings at the EP. The procedural irregularities, apparent biased and motivated nature of the selection, tokenistic manipulation of of the candidatures of female applicants, and the party-political handling of the decision by the EP strongly suggest that this is a flawed procedure with a biased, pre-determined outcome, intended to weaken a key institution of the EU at a critical moment in our fight to preserve fundamental human rights and the rule of law.

4      What, in your view, the institution should do to put things right.
The present selection procedure should be paused before the decision is taken to appoint a new EDPS, as the current procedure does not meet legal requirements for transparency and appears to have been manipulated to ensure a biased and pre-determined outcome.

The selection procedure then needs to be re-run from the point of selecting shortlisted candidates; with transparent, published and objective selection criteria and rankings, and with the identities of the selection committee made public to ensure there is no institutional bias in its operation. A subsequent vote in the EP which follows established procedure and is run along individual MEP lines, rather than by party fiat, is also needed to ensure the fact and appearance of a fair and transparent democratic process.

5      Whether the matter has already been settled by or is pending before a court.
This matter is still in process and has not been settled. Given the urgency and necessity of a fair and transparent outcome, we respectfully request a substantive reply within five working days regarding what steps you can to take to address this issue. If your office is unable to provide any indication of remedies, we believe urgency dictates that we must bring this issue to the attention of the Ombudsman after that time.

Our concern is not to advance the position of any specific candidate who meets basic standards of independence, but to ensure that the EDPS continues to play the robust and respected role it does today in protecting Europeans’ privacy and upholding the rule of law without fear or favour of any of the EU institutions.

We know that as President of the European Commission, you will be at pains to ensure this crucial role is filled in an open, transparent, and above all fair and non-discriminatory manner. We feel sure that you must also wish for the EDPS to continue to operate — as it notably does today — in a fully independent, objective and transparent manner.

We and many other European citizens and residents would be extremely grateful for your careful attention to this urgent and sensitive matter.

Yours sincerely,
Dr. Maria Farrell, Co. Kerry, IRELAND.
Prof. Douwe Korff, Cambridge, UK.
Prof. Ian Brown, La Isleta, Las Palmas de Gran Granaria, SPAIN.

[1] REGULATION (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data; Article 52.
[2] REGULATION (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data; Article 53.
[3] Ibid.
[4] Directorate-General, Human Resources and Security, https://commission.europa.eu/about/departments-and-executive-agencies/human-resources-and-security_en
[5] REGULATION (EU) 2018/1725, Article 53.
[6] EDPS v SRB (Notion de données à caractère personnel) Case C-413/23 P, important, on anonymization; Commission in support of SRB; Case C 698/23 P, (concerns data processing by Europol) EDPS v European Parliament, Council of the European Union. Appeal brought by the European Commission against the judgment of the General Court (Sixth Chamber, Extended Composition) of 8 January 2025 in Case T-354/22, Thomas Bindl v European Commission, lodged on 17 March 2025 (Case C-206/25 P).